14629 matches found
Category Meta <= 1.2.8 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Contact Form <= 2.0.10 - Form Styling Update via CSRF
Description The plugin does not have CSRF check when updating the contact form styling, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Short URL <= 1.6.8 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Simple Org Chart <= 2.3.4 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Simple Org Chart <= 2.3.4 - Unauthenticated Tree Settings Update
Description The plugin does not have authorisation when updating its Tree settings, which could allow unauthenticated attackers to change them...
DX-auto-save-images <= 1.4.0 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
WP Hide Pages <= 1.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Backend Localization <= 2.1.10 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Hide Admin Notices < 2.3.3 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Localize Remote Images <= 1.0.9 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Maintenance Switch <= 1.5.2 - Theme Files Creation/Deletion via CSRF
Description The plugin does not have CSRF checks when creating and deleting theme files as well as reseting settings, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
WP iCal Availability <= 1.0.3 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Profile Extra Fields by BestWebSoft < 1.2.8 - Unauthenticated Sensitive Data Disclosure
Description The plugin does not have authorisation in the prflxtrfldsexportfile function, allowing unauthenticated users to retrieve sensitive data such as the ones entered in custom fields...
WP Gallery Metabox <= 1.0.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
SIS Handball <= 1.0.45 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Smarty for WordPress <= 3.1.35 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Disabler <= 3.0.3 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
WP Bing Map Pro < 5.0 - CSRF
Description Cross-Site Request Forgery CSRF vulnerability in dan009 WP Bing Map Pro plugin 5.0 versions...
SB Child List <= 4.5 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Site Protector <= 2.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Mail SMTP Pro < 3.8.1 - Unauthenticated Email Address Disclosure
Description The plugin does not have authorisation in the isprintpage function, allowing unauthenticated users to retrieve sensitive information such as email address...
WP Responsive header image slider <= 3.2.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Use Memcached <= 1.0.5 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Sign-up Sheets < 2.2.9 - Settings Update/Reset via CSRF
Description The plugin does not have CSRF check in place when updating and reseting its settings, which could allow attackers to make a logged in admin change and reset them via a CSRF attack...
Social Proof Testimonials and Reviews by Repuso < 5.02 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
WP Tell a Friend Popup Form <= 7.1 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Keap Landing Pages <= 1.4.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Instant CSS < 1.2.2 - Theme/CSS/Minify/Preprocessor Data Update via CSRF
Description The plugin does not have CSRF checks when updating its Theme, CSS, Minify and Preprocessor data, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
Slick Contact Forms <= 1.3.7 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Mobile Address Bar Changer <= 3.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Instant CSS < 1.1.5 - Subscriber+ Unauthorised AJAX Calls
Description The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscriber to call them and modify/access theme and CSS data for example. It could also lead to Stored XSS issues...
CLUEVO LMS, E-Learning Platform < 1.11.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Thumbnail Slider With Lightbox < 1.0.1 - Image Lightboxes via CSRF
Description The plugin does not have CSRF check when deleting image lightboxes, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Perelink Pro <= 2.1.4 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP-FlyBox <= 6.46 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Oxygen Builder < 4.4 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Instagram for WordPress <= 2.1.6 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
AI Content Writing Assistant <= 1.1.5 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Kv TinyMCE Editor Add Fonts <= 1.1 - Font List Update via CSRF
Description The plugin does not have CSRF check when updating its font list, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Google Map Shortcode <= 3.1.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Realbig <= 1.0.6 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings as well as clear logs and cache, which could allow attackers to make a logged in admin change them via a CSRF attack...
ShortCodes UI <= 1.9.8 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Woocommerce ESTO < 2.23.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Checkfront Online Booking System < 3.7 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Post View Count <= 1.8.4 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Remove slug from custom post type <= 1.0.3 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Shockingly Simple Favicon <= 1.8.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
MakeStories (for Google Web Stories) <= 2.8.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Live News < 1.07 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Video Gallery & Management < 3.3.6 - Settings Update via CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...